R12 — Known forwarder, expected SPF-fail signature (informational)

Triggers when: a source explicitly labeled as a known forwarder in the allowlist shows an SPF-only failure — the textbook signature of forwarded mail, where the forwarder's envelope sender doesn't align with the original header_from, but the original DKIM signature usually still survives and covers the message.

What to do: nothing — this rule exists specifically so a legitimate, already-identified forwarder doesn't get flagged under R1/R5 alongside genuine problems. It's informational, explicitly "no action," not a hidden warning.